[Snort-users] Problem running in daemon mode

Chris Green cmg at ...1935...
Tue Mar 12 16:33:02 EST 2002


Dany Allard <dallard at ...1295...> writes:

> Hello
>
>   I am having a problem, that when I run Snort with the -D flag the card
> is not running in PROMISC mode.
>
>   I can run snort with from the command line using
>    ./snort -b -c /etc/snort/snort.conf -h xxx.xxx.xxx.0/24 -i eth1
> and everything runs fine and if I run ifconfig the card shows as " UP
> BROADCAST RUNNING PROMISC MULTICAST "
> when I run the following
>         /usr/local/bin/snort -D -b -c /etc/snort/snort.conf -h
> xxx.xxx.xxx.0/24 -i eth1
>  I don't see any traffic in the logs and if I run ifconfig the card
> shows as "UP BROADCAST RUNNING MULTICAST".
>
> Has anyone seen this problem before (I saw similar problems going back
> through the snort-users mailing list but nothing that fixed my problem).

What does ifconfig show when you have no snort running?

Sometimes it gets confused and leaves the interface in promiscious
mode and there is only a toggle switch IIRC on the pcap open so it
will alter it back to non-promisc.


-- 
Chris Green <cmg at ...1935...>
"Yeah, but you're taking the universe out of context."





More information about the Snort-users mailing list